Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-76867

Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting in Route/NAT Configuration CGI Handlers

CVSS 4.0 5.1 MEDIUMCVSS 3.1 5.4 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-76867

Published

Netcore NR255-V firmware version 1.5.130703 contains a stored cross-site scripting vulnerability in routing and NAT configuration CGI components including routing_tab_add_cgi, routing_table_list_show_cgi, route_policy_add_cgi, and route_policy_parame_show_cgi. Attackers can inject persistent script payloads through these route and NAT configuration pages, which are then executed in the context of users viewing the affected pages.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-76867

Published

NR255-V

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Netcore",
                    "product": "NR255-V",
                    "defaultStatus": "unaffected",
                    "versions": [
                        {
                            "version": "1.5.130703",
                            "status": "affected",
                            "versionType": "custom"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON